CVE-2026-44160

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10	Patch
https://github.com/fluent/fluentd/pull/5393	Issue Tracking Patch
https://github.com/fluent/fluentd/releases/tag/v1.19.3	Product Release Notes
https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop y así sucesivamente. Antes de la versión 1.19.3, los plugins in_http e in_forward de Fluentd soportan datos comprimidos con gzip, pero aplican límites solo a las cargas útiles comprimidas a través de configuraciones como body_size_limit y chunk_size_limit, permitiendo que cargas útiles comprimidas elaboradas se descompriman en memoria a un tamaño excesivo y causen denegación de servicio a través del agotamiento de la memoria. Este problema está solucionado en la versión 1.19.3.

Information

Published : 2026-07-08 22:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44160

Mitre link : CVE-2026-44160

CVE.ORG link : CVE-2026-44160

JSON object : View

Products Affected

fluentd

fluentd

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2026-44160", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44160", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:34:49.901088Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}]}], "published": "2026-07-08T22:17:14.600", "references": [{"url": "https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/pull/5393", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop y as\u00ed sucesivamente. Antes de la versi\u00f3n 1.19.3, los plugins in_http e in_forward de Fluentd soportan datos comprimidos con gzip, pero aplican l\u00edmites solo a las cargas \u00fatiles comprimidas a trav\u00e9s de configuraciones como body_size_limit y chunk_size_limit, permitiendo que cargas \u00fatiles comprimidas elaboradas se descompriman en memoria a un tama\u00f1o excesivo y causen denegaci\u00f3n de servicio a trav\u00e9s del agotamiento de la memoria. Este problema est\u00e1 solucionado en la versi\u00f3n 1.19.3."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}